6.01 - Hosts reaching out to many other hosts or ports per hour
April 24, 2024 ยท View on GitHub
Detect hosts reaching out to many other hosts or ports (> 10) in any given hour, indicating potential scanning activity or infected hosts. List corresponding subnets.
Category: Network Activity
Use Cases: Audit, Detect
Data Sources: VPC Flow Logs
Queries or Rules
| BigQuery | Log Analytics | Google SecOps |
|---|---|---|
| SQL | SQL | YARA-L |
Event Generation
No event generation steps provided. Contribute emulation test to this use case.
Sample Event
No log samples provided. Contribute log samples to this use case.